qemu/hw/ssi/xilinx_spips.c
<<
>>
Prefs
   1/*
   2 * QEMU model of the Xilinx Zynq SPI controller
   3 *
   4 * Copyright (c) 2012 Peter A. G. Crosthwaite
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "hw/sysbus.h"
  27#include "hw/irq.h"
  28#include "hw/ptimer.h"
  29#include "hw/qdev-properties.h"
  30#include "qemu/log.h"
  31#include "qemu/module.h"
  32#include "qemu/bitops.h"
  33#include "hw/ssi/xilinx_spips.h"
  34#include "qapi/error.h"
  35#include "hw/register.h"
  36#include "sysemu/dma.h"
  37#include "migration/blocker.h"
  38#include "migration/vmstate.h"
  39
  40#ifndef XILINX_SPIPS_ERR_DEBUG
  41#define XILINX_SPIPS_ERR_DEBUG 0
  42#endif
  43
  44#define DB_PRINT_L(level, ...) do { \
  45    if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
  46        fprintf(stderr,  ": %s: ", __func__); \
  47        fprintf(stderr, ## __VA_ARGS__); \
  48    } \
  49} while (0)
  50
  51/* config register */
  52#define R_CONFIG            (0x00 / 4)
  53#define IFMODE              (1U << 31)
  54#define R_CONFIG_ENDIAN     (1 << 26)
  55#define MODEFAIL_GEN_EN     (1 << 17)
  56#define MAN_START_COM       (1 << 16)
  57#define MAN_START_EN        (1 << 15)
  58#define MANUAL_CS           (1 << 14)
  59#define CS                  (0xF << 10)
  60#define CS_SHIFT            (10)
  61#define PERI_SEL            (1 << 9)
  62#define REF_CLK             (1 << 8)
  63#define FIFO_WIDTH          (3 << 6)
  64#define BAUD_RATE_DIV       (7 << 3)
  65#define CLK_PH              (1 << 2)
  66#define CLK_POL             (1 << 1)
  67#define MODE_SEL            (1 << 0)
  68#define R_CONFIG_RSVD       (0x7bf40000)
  69
  70/* interrupt mechanism */
  71#define R_INTR_STATUS       (0x04 / 4)
  72#define R_INTR_STATUS_RESET (0x104)
  73#define R_INTR_EN           (0x08 / 4)
  74#define R_INTR_DIS          (0x0C / 4)
  75#define R_INTR_MASK         (0x10 / 4)
  76#define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
  77/* Poll timeout not implemented */
  78#define IXR_RX_FIFO_EMPTY       (1 << 11)
  79#define IXR_GENERIC_FIFO_FULL   (1 << 10)
  80#define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
  81#define IXR_TX_FIFO_EMPTY       (1 << 8)
  82#define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
  83#define IXR_RX_FIFO_FULL        (1 << 5)
  84#define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
  85#define IXR_TX_FIFO_FULL        (1 << 3)
  86#define IXR_TX_FIFO_NOT_FULL    (1 << 2)
  87#define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
  88#define IXR_RX_FIFO_OVERFLOW    (1 << 0)
  89#define IXR_ALL                 ((1 << 13) - 1)
  90#define GQSPI_IXR_MASK          0xFBE
  91#define IXR_SELF_CLEAR \
  92(IXR_GENERIC_FIFO_EMPTY \
  93| IXR_GENERIC_FIFO_FULL  \
  94| IXR_GENERIC_FIFO_NOT_FULL \
  95| IXR_TX_FIFO_EMPTY \
  96| IXR_TX_FIFO_FULL  \
  97| IXR_TX_FIFO_NOT_FULL \
  98| IXR_RX_FIFO_EMPTY \
  99| IXR_RX_FIFO_FULL  \
 100| IXR_RX_FIFO_NOT_EMPTY)
 101
 102#define R_EN                (0x14 / 4)
 103#define R_DELAY             (0x18 / 4)
 104#define R_TX_DATA           (0x1C / 4)
 105#define R_RX_DATA           (0x20 / 4)
 106#define R_SLAVE_IDLE_COUNT  (0x24 / 4)
 107#define R_TX_THRES          (0x28 / 4)
 108#define R_RX_THRES          (0x2C / 4)
 109#define R_GPIO              (0x30 / 4)
 110#define R_LPBK_DLY_ADJ      (0x38 / 4)
 111#define R_LPBK_DLY_ADJ_RESET (0x33)
 112#define R_IOU_TAPDLY_BYPASS (0x3C / 4)
 113#define R_TXD1              (0x80 / 4)
 114#define R_TXD2              (0x84 / 4)
 115#define R_TXD3              (0x88 / 4)
 116
 117#define R_LQSPI_CFG         (0xa0 / 4)
 118#define R_LQSPI_CFG_RESET       0x03A002EB
 119#define LQSPI_CFG_LQ_MODE       (1U << 31)
 120#define LQSPI_CFG_TWO_MEM       (1 << 30)
 121#define LQSPI_CFG_SEP_BUS       (1 << 29)
 122#define LQSPI_CFG_U_PAGE        (1 << 28)
 123#define LQSPI_CFG_ADDR4         (1 << 27)
 124#define LQSPI_CFG_MODE_EN       (1 << 25)
 125#define LQSPI_CFG_MODE_WIDTH    8
 126#define LQSPI_CFG_MODE_SHIFT    16
 127#define LQSPI_CFG_DUMMY_WIDTH   3
 128#define LQSPI_CFG_DUMMY_SHIFT   8
 129#define LQSPI_CFG_INST_CODE     0xFF
 130
 131#define R_CMND        (0xc0 / 4)
 132    #define R_CMND_RXFIFO_DRAIN   (1 << 19)
 133    FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
 134#define R_CMND_EXT_ADD        (1 << 15)
 135    FIELD(CMND, RX_DISCARD, 8, 7)
 136    FIELD(CMND, DUMMY_CYCLES, 2, 6)
 137#define R_CMND_DMA_EN         (1 << 1)
 138#define R_CMND_PUSH_WAIT      (1 << 0)
 139#define R_TRANSFER_SIZE     (0xc4 / 4)
 140#define R_LQSPI_STS         (0xA4 / 4)
 141#define LQSPI_STS_WR_RECVD      (1 << 1)
 142
 143#define R_DUMMY_CYCLE_EN    (0xC8 / 4)
 144#define R_ECO               (0xF8 / 4)
 145#define R_MOD_ID            (0xFC / 4)
 146
 147#define R_GQSPI_SELECT          (0x144 / 4)
 148    FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
 149#define R_GQSPI_ISR         (0x104 / 4)
 150#define R_GQSPI_IER         (0x108 / 4)
 151#define R_GQSPI_IDR         (0x10c / 4)
 152#define R_GQSPI_IMR         (0x110 / 4)
 153#define R_GQSPI_IMR_RESET   (0xfbe)
 154#define R_GQSPI_TX_THRESH   (0x128 / 4)
 155#define R_GQSPI_RX_THRESH   (0x12c / 4)
 156#define R_GQSPI_GPIO (0x130 / 4)
 157#define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
 158#define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
 159#define R_GQSPI_CNFG        (0x100 / 4)
 160    FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
 161    FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
 162    FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
 163    FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
 164    /* Poll timeout not implemented */
 165    FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
 166    /* QEMU doesnt care about any of these last three */
 167    FIELD(GQSPI_CNFG, BR, 3, 3)
 168    FIELD(GQSPI_CNFG, CPH, 2, 1)
 169    FIELD(GQSPI_CNFG, CPL, 1, 1)
 170#define R_GQSPI_GEN_FIFO        (0x140 / 4)
 171#define R_GQSPI_TXD             (0x11c / 4)
 172#define R_GQSPI_RXD             (0x120 / 4)
 173#define R_GQSPI_FIFO_CTRL       (0x14c / 4)
 174    FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
 175    FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
 176    FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
 177#define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
 178#define R_GQSPI_DATA_STS (0x15c / 4)
 179/* We use the snapshot register to hold the core state for the currently
 180 * or most recently executed command. So the generic fifo format is defined
 181 * for the snapshot register
 182 */
 183#define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
 184    FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
 185    FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
 186    FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
 187    FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
 188    FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
 189    FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
 190    FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
 191    FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
 192    FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
 193    FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
 194#define R_GQSPI_MOD_ID        (0x1fc / 4)
 195#define R_GQSPI_MOD_ID_RESET  (0x10a0000)
 196
 197#define R_QSPIDMA_DST_CTRL         (0x80c / 4)
 198#define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
 199#define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
 200#define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
 201#define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
 202#define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
 203
 204/* size of TXRX FIFOs */
 205#define RXFF_A          (128)
 206#define TXFF_A          (128)
 207
 208#define RXFF_A_Q          (64 * 4)
 209#define TXFF_A_Q          (64 * 4)
 210
 211/* 16MB per linear region */
 212#define LQSPI_ADDRESS_BITS 24
 213
 214#define SNOOP_CHECKING 0xFF
 215#define SNOOP_ADDR 0xF0
 216#define SNOOP_NONE 0xEE
 217#define SNOOP_STRIPING 0
 218
 219#define MIN_NUM_BUSSES 1
 220#define MAX_NUM_BUSSES 2
 221
 222static inline int num_effective_busses(XilinxSPIPS *s)
 223{
 224    return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
 225            s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
 226}
 227
 228static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
 229{
 230    int i;
 231
 232    for (i = 0; i < s->num_cs * s->num_busses; i++) {
 233        bool old_state = s->cs_lines_state[i];
 234        bool new_state = field & (1 << i);
 235
 236        if (old_state != new_state) {
 237            s->cs_lines_state[i] = new_state;
 238            s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
 239            DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
 240        }
 241        qemu_set_irq(s->cs_lines[i], !new_state);
 242    }
 243    if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
 244        s->snoop_state = SNOOP_CHECKING;
 245        s->cmd_dummies = 0;
 246        s->link_state = 1;
 247        s->link_state_next = 1;
 248        s->link_state_next_when = 0;
 249        DB_PRINT_L(1, "moving to snoop check state\n");
 250    }
 251}
 252
 253static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
 254{
 255    if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
 256        int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
 257        bool upper_cs_sel = field & (1 << 1);
 258        bool lower_cs_sel = field & 1;
 259        bool bus0_enabled;
 260        bool bus1_enabled;
 261        uint8_t buses;
 262        int cs = 0;
 263
 264        buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 265        bus0_enabled = buses & 1;
 266        bus1_enabled = buses & (1 << 1);
 267
 268        if (bus0_enabled && bus1_enabled) {
 269            if (lower_cs_sel) {
 270                cs |= 1;
 271            }
 272            if (upper_cs_sel) {
 273                cs |= 1 << 3;
 274            }
 275        } else if (bus0_enabled) {
 276            if (lower_cs_sel) {
 277                cs |= 1;
 278            }
 279            if (upper_cs_sel) {
 280                cs |= 1 << 1;
 281            }
 282        } else if (bus1_enabled) {
 283            if (lower_cs_sel) {
 284                cs |= 1 << 2;
 285            }
 286            if (upper_cs_sel) {
 287                cs |= 1 << 3;
 288            }
 289        }
 290        xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
 291    }
 292}
 293
 294static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
 295{
 296    int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
 297
 298    /* In dual parallel, mirror low CS to both */
 299    if (num_effective_busses(s) == 2) {
 300        /* Single bit chip-select for qspi */
 301        field &= 0x1;
 302        field |= field << 3;
 303    /* Dual stack U-Page */
 304    } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
 305               s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
 306        /* Single bit chip-select for qspi */
 307        field &= 0x1;
 308        /* change from CS0 to CS1 */
 309        field <<= 1;
 310    }
 311    /* Auto CS */
 312    if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
 313        fifo8_is_empty(&s->tx_fifo)) {
 314        field = 0;
 315    }
 316    xilinx_spips_update_cs(s, field);
 317}
 318
 319static void xilinx_spips_update_ixr(XilinxSPIPS *s)
 320{
 321    if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
 322        s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
 323        s->regs[R_INTR_STATUS] |=
 324            (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
 325            (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
 326                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
 327            (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
 328            (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
 329            (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
 330    }
 331    int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
 332                                                                IXR_ALL);
 333    if (new_irqline != s->irqline) {
 334        s->irqline = new_irqline;
 335        qemu_set_irq(s->irq, s->irqline);
 336    }
 337}
 338
 339static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
 340{
 341    uint32_t gqspi_int;
 342    int new_irqline;
 343
 344    s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
 345    s->regs[R_GQSPI_ISR] |=
 346        (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
 347        (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
 348        (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
 349                                    IXR_GENERIC_FIFO_NOT_FULL : 0) |
 350        (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
 351        (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
 352        (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
 353                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
 354        (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
 355        (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
 356        (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
 357                                    IXR_TX_FIFO_NOT_FULL : 0);
 358
 359    /* GQSPI Interrupt Trigger Status */
 360    gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
 361    new_irqline = !!(gqspi_int & IXR_ALL);
 362
 363    /* drive external interrupt pin */
 364    if (new_irqline != s->gqspi_irqline) {
 365        s->gqspi_irqline = new_irqline;
 366        qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
 367    }
 368}
 369
 370static void xilinx_spips_reset(DeviceState *d)
 371{
 372    XilinxSPIPS *s = XILINX_SPIPS(d);
 373
 374    memset(s->regs, 0, sizeof(s->regs));
 375
 376    fifo8_reset(&s->rx_fifo);
 377    fifo8_reset(&s->rx_fifo);
 378    /* non zero resets */
 379    s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
 380    s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
 381    s->regs[R_TX_THRES] = 1;
 382    s->regs[R_RX_THRES] = 1;
 383    /* FIXME: move magic number definition somewhere sensible */
 384    s->regs[R_MOD_ID] = 0x01090106;
 385    s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
 386    s->link_state = 1;
 387    s->link_state_next = 1;
 388    s->link_state_next_when = 0;
 389    s->snoop_state = SNOOP_CHECKING;
 390    s->cmd_dummies = 0;
 391    s->man_start_com = false;
 392    xilinx_spips_update_ixr(s);
 393    xilinx_spips_update_cs_lines(s);
 394}
 395
 396static void xlnx_zynqmp_qspips_reset(DeviceState *d)
 397{
 398    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
 399
 400    xilinx_spips_reset(d);
 401
 402    memset(s->regs, 0, sizeof(s->regs));
 403
 404    fifo8_reset(&s->rx_fifo_g);
 405    fifo8_reset(&s->rx_fifo_g);
 406    fifo32_reset(&s->fifo_g);
 407    s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
 408    s->regs[R_GPIO] = 1;
 409    s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
 410    s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
 411    s->regs[R_MOD_ID] = 0x01090101;
 412    s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
 413    s->regs[R_GQSPI_TX_THRESH] = 1;
 414    s->regs[R_GQSPI_RX_THRESH] = 1;
 415    s->regs[R_GQSPI_GPIO] = 1;
 416    s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
 417    s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
 418    s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
 419    s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
 420    s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
 421    s->man_start_com_g = false;
 422    s->gqspi_irqline = 0;
 423    xlnx_zynqmp_qspips_update_ixr(s);
 424}
 425
 426/* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
 427 * column wise (from element 0 to N-1). num is the length of x, and dir
 428 * reverses the direction of the transform. Best illustrated by example:
 429 * Each digit in the below array is a single bit (num == 3):
 430 *
 431 * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
 432 *  { hgfedcba, }                                      { 630fcHEB, }
 433 *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
 434 */
 435
 436static inline void stripe8(uint8_t *x, int num, bool dir)
 437{
 438    uint8_t r[MAX_NUM_BUSSES];
 439    int idx[2] = {0, 0};
 440    int bit[2] = {0, 7};
 441    int d = dir;
 442
 443    assert(num <= MAX_NUM_BUSSES);
 444    memset(r, 0, sizeof(uint8_t) * num);
 445
 446    for (idx[0] = 0; idx[0] < num; ++idx[0]) {
 447        for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
 448            r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
 449            idx[1] = (idx[1] + 1) % num;
 450            if (!idx[1]) {
 451                bit[1]--;
 452            }
 453        }
 454    }
 455    memcpy(x, r, sizeof(uint8_t) * num);
 456}
 457
 458static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
 459{
 460    while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
 461        uint8_t tx_rx[2] = { 0 };
 462        int num_stripes = 1;
 463        uint8_t busses;
 464        int i;
 465
 466        if (!s->regs[R_GQSPI_DATA_STS]) {
 467            uint8_t imm;
 468
 469            s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
 470            DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
 471            if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
 472                DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
 473                continue;
 474            }
 475            xlnx_zynqmp_qspips_update_cs_lines(s);
 476
 477            imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 478            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 479                /* immedate transfer */
 480                if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 481                    ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 482                    s->regs[R_GQSPI_DATA_STS] = 1;
 483                /* CS setup/hold - do nothing */
 484                } else {
 485                    s->regs[R_GQSPI_DATA_STS] = 0;
 486                }
 487            } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
 488                if (imm > 31) {
 489                    qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
 490                                  " long - 2 ^ %" PRId8 " requested\n", imm);
 491                }
 492                s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
 493            } else {
 494                s->regs[R_GQSPI_DATA_STS] = imm;
 495            }
 496        }
 497        /* Zero length transfer check */
 498        if (!s->regs[R_GQSPI_DATA_STS]) {
 499            continue;
 500        }
 501        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
 502            fifo8_is_full(&s->rx_fifo_g)) {
 503            /* No space in RX fifo for transfer - try again later */
 504            return;
 505        }
 506        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
 507            (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 508             ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
 509            num_stripes = 2;
 510        }
 511        if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 512            tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
 513                                        GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 514        } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
 515            for (i = 0; i < num_stripes; ++i) {
 516                if (!fifo8_is_empty(&s->tx_fifo_g)) {
 517                    tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
 518                    s->tx_fifo_g_align++;
 519                } else {
 520                    return;
 521                }
 522            }
 523        }
 524        if (num_stripes == 1) {
 525            /* mirror */
 526            tx_rx[1] = tx_rx[0];
 527        }
 528        busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 529        for (i = 0; i < 2; ++i) {
 530            DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
 531            tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
 532            DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
 533        }
 534        if (s->regs[R_GQSPI_DATA_STS] > 1 &&
 535            busses == 0x3 && num_stripes == 2) {
 536            s->regs[R_GQSPI_DATA_STS] -= 2;
 537        } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
 538            s->regs[R_GQSPI_DATA_STS]--;
 539        }
 540        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 541            for (i = 0; i < 2; ++i) {
 542                if (busses & (1 << i)) {
 543                    DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
 544                    fifo8_push(&s->rx_fifo_g, tx_rx[i]);
 545                    s->rx_fifo_g_align++;
 546                }
 547            }
 548        }
 549        if (!s->regs[R_GQSPI_DATA_STS]) {
 550            for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
 551                fifo8_pop(&s->tx_fifo_g);
 552            }
 553            for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
 554                fifo8_push(&s->rx_fifo_g, 0);
 555            }
 556        }
 557    }
 558}
 559
 560static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
 561{
 562    if (!qs) {
 563        /* The SPI device is not a QSPI device */
 564        return -1;
 565    }
 566
 567    switch (command) { /* check for dummies */
 568    case READ: /* no dummy bytes/cycles */
 569    case PP:
 570    case DPP:
 571    case QPP:
 572    case READ_4:
 573    case PP_4:
 574    case QPP_4:
 575        return 0;
 576    case FAST_READ:
 577    case DOR:
 578    case QOR:
 579    case DOR_4:
 580    case QOR_4:
 581        return 1;
 582    case DIOR:
 583    case FAST_READ_4:
 584    case DIOR_4:
 585        return 2;
 586    case QIOR:
 587    case QIOR_4:
 588        return 4;
 589    default:
 590        return -1;
 591    }
 592}
 593
 594static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
 595{
 596   switch (cmd) {
 597   case PP_4:
 598   case QPP_4:
 599   case READ_4:
 600   case QIOR_4:
 601   case FAST_READ_4:
 602   case DOR_4:
 603   case QOR_4:
 604   case DIOR_4:
 605       return 4;
 606   default:
 607       return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
 608   }
 609}
 610
 611static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
 612{
 613    int debug_level = 0;
 614    XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
 615                                                           TYPE_XILINX_QSPIPS);
 616
 617    for (;;) {
 618        int i;
 619        uint8_t tx = 0;
 620        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
 621        uint8_t dummy_cycles = 0;
 622        uint8_t addr_length;
 623
 624        if (fifo8_is_empty(&s->tx_fifo)) {
 625            xilinx_spips_update_ixr(s);
 626            return;
 627        } else if (s->snoop_state == SNOOP_STRIPING ||
 628                   s->snoop_state == SNOOP_NONE) {
 629            for (i = 0; i < num_effective_busses(s); ++i) {
 630                tx_rx[i] = fifo8_pop(&s->tx_fifo);
 631            }
 632            stripe8(tx_rx, num_effective_busses(s), false);
 633        } else if (s->snoop_state >= SNOOP_ADDR) {
 634            tx = fifo8_pop(&s->tx_fifo);
 635            for (i = 0; i < num_effective_busses(s); ++i) {
 636                tx_rx[i] = tx;
 637            }
 638        } else {
 639            /* Extract a dummy byte and generate dummy cycles according to the
 640             * link state */
 641            tx = fifo8_pop(&s->tx_fifo);
 642            dummy_cycles = 8 / s->link_state;
 643        }
 644
 645        for (i = 0; i < num_effective_busses(s); ++i) {
 646            int bus = num_effective_busses(s) - 1 - i;
 647            if (dummy_cycles) {
 648                int d;
 649                for (d = 0; d < dummy_cycles; ++d) {
 650                    tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
 651                }
 652            } else {
 653                DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
 654                tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
 655                DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
 656            }
 657        }
 658
 659        if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
 660            DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
 661            /* Do nothing */
 662        } else if (s->rx_discard) {
 663            DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
 664            s->rx_discard -= 8 / s->link_state;
 665        } else if (fifo8_is_full(&s->rx_fifo)) {
 666            s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
 667            DB_PRINT_L(0, "rx FIFO overflow");
 668        } else if (s->snoop_state == SNOOP_STRIPING) {
 669            stripe8(tx_rx, num_effective_busses(s), true);
 670            for (i = 0; i < num_effective_busses(s); ++i) {
 671                fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
 672                DB_PRINT_L(debug_level, "pushing striped rx byte\n");
 673            }
 674        } else {
 675           DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
 676           fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
 677        }
 678
 679        if (s->link_state_next_when) {
 680            s->link_state_next_when--;
 681            if (!s->link_state_next_when) {
 682                s->link_state = s->link_state_next;
 683            }
 684        }
 685
 686        DB_PRINT_L(debug_level, "initial snoop state: %x\n",
 687                   (unsigned)s->snoop_state);
 688        switch (s->snoop_state) {
 689        case (SNOOP_CHECKING):
 690            /* Store the count of dummy bytes in the txfifo */
 691            s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
 692            addr_length = get_addr_length(s, tx);
 693            if (s->cmd_dummies < 0) {
 694                s->snoop_state = SNOOP_NONE;
 695            } else {
 696                s->snoop_state = SNOOP_ADDR + addr_length - 1;
 697            }
 698            switch (tx) {
 699            case DPP:
 700            case DOR:
 701            case DOR_4:
 702                s->link_state_next = 2;
 703                s->link_state_next_when = addr_length + s->cmd_dummies;
 704                break;
 705            case QPP:
 706            case QPP_4:
 707            case QOR:
 708            case QOR_4:
 709                s->link_state_next = 4;
 710                s->link_state_next_when = addr_length + s->cmd_dummies;
 711                break;
 712            case DIOR:
 713            case DIOR_4:
 714                s->link_state = 2;
 715                break;
 716            case QIOR:
 717            case QIOR_4:
 718                s->link_state = 4;
 719                break;
 720            }
 721            break;
 722        case (SNOOP_ADDR):
 723            /* Address has been transmitted, transmit dummy cycles now if
 724             * needed */
 725            if (s->cmd_dummies < 0) {
 726                s->snoop_state = SNOOP_NONE;
 727            } else {
 728                s->snoop_state = s->cmd_dummies;
 729            }
 730            break;
 731        case (SNOOP_STRIPING):
 732        case (SNOOP_NONE):
 733            /* Once we hit the boring stuff - squelch debug noise */
 734            if (!debug_level) {
 735                DB_PRINT_L(0, "squelching debug info ....\n");
 736                debug_level = 1;
 737            }
 738            break;
 739        default:
 740            s->snoop_state--;
 741        }
 742        DB_PRINT_L(debug_level, "final snoop state: %x\n",
 743                   (unsigned)s->snoop_state);
 744    }
 745}
 746
 747static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
 748{
 749    int i;
 750    for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
 751        if (be) {
 752            fifo8_push(fifo, (uint8_t)(value >> 24));
 753            value <<= 8;
 754        } else {
 755            fifo8_push(fifo, (uint8_t)value);
 756            value >>= 8;
 757        }
 758    }
 759}
 760
 761static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
 762{
 763    if (!s->regs[R_TRANSFER_SIZE]) {
 764        return;
 765    }
 766    if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
 767        return;
 768    }
 769    /*
 770     * The zero pump must never fill tx fifo such that rx overflow is
 771     * possible
 772     */
 773    while (s->regs[R_TRANSFER_SIZE] &&
 774           s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
 775        /* endianess just doesn't matter when zero pumping */
 776        tx_data_bytes(&s->tx_fifo, 0, 4, false);
 777        s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
 778        s->regs[R_TRANSFER_SIZE] -= 4;
 779    }
 780}
 781
 782static void xilinx_spips_check_flush(XilinxSPIPS *s)
 783{
 784    if (s->man_start_com ||
 785        (!fifo8_is_empty(&s->tx_fifo) &&
 786         !(s->regs[R_CONFIG] & MAN_START_EN))) {
 787        xilinx_spips_check_zero_pump(s);
 788        xilinx_spips_flush_txfifo(s);
 789    }
 790    if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
 791        s->man_start_com = false;
 792    }
 793    xilinx_spips_update_ixr(s);
 794}
 795
 796static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
 797{
 798    bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
 799                          !fifo32_is_empty(&s->fifo_g);
 800
 801    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 802        if (s->man_start_com_g || (gqspi_has_work &&
 803             !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
 804            xlnx_zynqmp_qspips_flush_fifo_g(s);
 805        }
 806    } else {
 807        xilinx_spips_check_flush(XILINX_SPIPS(s));
 808    }
 809    if (!gqspi_has_work) {
 810        s->man_start_com_g = false;
 811    }
 812    xlnx_zynqmp_qspips_update_ixr(s);
 813}
 814
 815static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
 816{
 817    int i;
 818
 819    for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
 820        value[i] = fifo8_pop(fifo);
 821    }
 822    return max - i;
 823}
 824
 825static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
 826{
 827    void *ret;
 828
 829    if (max == 0 || max > fifo->num) {
 830        abort();
 831    }
 832    *num = MIN(fifo->capacity - fifo->head, max);
 833    ret = &fifo->data[fifo->head];
 834    fifo->head += *num;
 835    fifo->head %= fifo->capacity;
 836    fifo->num -= *num;
 837    return ret;
 838}
 839
 840static void xlnx_zynqmp_qspips_notify(void *opaque)
 841{
 842    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
 843    XilinxSPIPS *s = XILINX_SPIPS(rq);
 844    Fifo8 *recv_fifo;
 845
 846    if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 847        if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
 848            return;
 849        }
 850        recv_fifo = &rq->rx_fifo_g;
 851    } else {
 852        if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
 853            return;
 854        }
 855        recv_fifo = &s->rx_fifo;
 856    }
 857    while (recv_fifo->num >= 4
 858           && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
 859    {
 860        size_t ret;
 861        uint32_t num;
 862        const void *rxd;
 863        int len;
 864
 865        len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
 866                                                   recv_fifo->num;
 867        rxd = pop_buf(recv_fifo, len, &num);
 868
 869        memcpy(rq->dma_buf, rxd, num);
 870
 871        ret = stream_push(rq->dma, rq->dma_buf, num);
 872        assert(ret == num);
 873        xlnx_zynqmp_qspips_check_flush(rq);
 874    }
 875}
 876
 877static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
 878                                                        unsigned size)
 879{
 880    XilinxSPIPS *s = opaque;
 881    uint32_t mask = ~0;
 882    uint32_t ret;
 883    uint8_t rx_buf[4];
 884    int shortfall;
 885
 886    addr >>= 2;
 887    switch (addr) {
 888    case R_CONFIG:
 889        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 890        break;
 891    case R_INTR_STATUS:
 892        ret = s->regs[addr] & IXR_ALL;
 893        s->regs[addr] = 0;
 894        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 895        xilinx_spips_update_ixr(s);
 896        return ret;
 897    case R_INTR_MASK:
 898        mask = IXR_ALL;
 899        break;
 900    case  R_EN:
 901        mask = 0x1;
 902        break;
 903    case R_SLAVE_IDLE_COUNT:
 904        mask = 0xFF;
 905        break;
 906    case R_MOD_ID:
 907        mask = 0x01FFFFFF;
 908        break;
 909    case R_INTR_EN:
 910    case R_INTR_DIS:
 911    case R_TX_DATA:
 912        mask = 0;
 913        break;
 914    case R_RX_DATA:
 915        memset(rx_buf, 0, sizeof(rx_buf));
 916        shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
 917        ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
 918                        cpu_to_be32(*(uint32_t *)rx_buf) :
 919                        cpu_to_le32(*(uint32_t *)rx_buf);
 920        if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
 921            ret <<= 8 * shortfall;
 922        }
 923        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 924        xilinx_spips_check_flush(s);
 925        xilinx_spips_update_ixr(s);
 926        return ret;
 927    }
 928    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
 929               s->regs[addr] & mask);
 930    return s->regs[addr] & mask;
 931
 932}
 933
 934static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
 935                                        hwaddr addr, unsigned size)
 936{
 937    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
 938    uint32_t reg = addr / 4;
 939    uint32_t ret;
 940    uint8_t rx_buf[4];
 941    int shortfall;
 942
 943    if (reg <= R_MOD_ID) {
 944        return xilinx_spips_read(opaque, addr, size);
 945    } else {
 946        switch (reg) {
 947        case R_GQSPI_RXD:
 948            if (fifo8_is_empty(&s->rx_fifo_g)) {
 949                qemu_log_mask(LOG_GUEST_ERROR,
 950                              "Read from empty GQSPI RX FIFO\n");
 951                return 0;
 952            }
 953            memset(rx_buf, 0, sizeof(rx_buf));
 954            shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
 955                                      XILINX_SPIPS(s)->num_txrx_bytes);
 956            ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
 957                  cpu_to_be32(*(uint32_t *)rx_buf) :
 958                  cpu_to_le32(*(uint32_t *)rx_buf);
 959            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
 960                ret <<= 8 * shortfall;
 961            }
 962            xlnx_zynqmp_qspips_check_flush(s);
 963            xlnx_zynqmp_qspips_update_ixr(s);
 964            return ret;
 965        default:
 966            return s->regs[reg];
 967        }
 968    }
 969}
 970
 971static void xilinx_spips_write(void *opaque, hwaddr addr,
 972                                        uint64_t value, unsigned size)
 973{
 974    int mask = ~0;
 975    XilinxSPIPS *s = opaque;
 976    bool try_flush = true;
 977
 978    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
 979    addr >>= 2;
 980    switch (addr) {
 981    case R_CONFIG:
 982        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 983        if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
 984            s->man_start_com = true;
 985        }
 986        break;
 987    case R_INTR_STATUS:
 988        mask = IXR_ALL;
 989        s->regs[R_INTR_STATUS] &= ~(mask & value);
 990        goto no_reg_update;
 991    case R_INTR_DIS:
 992        mask = IXR_ALL;
 993        s->regs[R_INTR_MASK] &= ~(mask & value);
 994        goto no_reg_update;
 995    case R_INTR_EN:
 996        mask = IXR_ALL;
 997        s->regs[R_INTR_MASK] |= mask & value;
 998        goto no_reg_update;
 999    case R_EN:
1000        mask = 0x1;
1001        break;
1002    case R_SLAVE_IDLE_COUNT:
1003        mask = 0xFF;
1004        break;
1005    case R_RX_DATA:
1006    case R_INTR_MASK:
1007    case R_MOD_ID:
1008        mask = 0;
1009        break;
1010    case R_TX_DATA:
1011        tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1012                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1013        goto no_reg_update;
1014    case R_TXD1:
1015        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1016                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1017        goto no_reg_update;
1018    case R_TXD2:
1019        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1020                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1021        goto no_reg_update;
1022    case R_TXD3:
1023        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1024                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1025        goto no_reg_update;
1026    /* Skip SPI bus update for below registers writes */
1027    case R_GPIO:
1028    case R_LPBK_DLY_ADJ:
1029    case R_IOU_TAPDLY_BYPASS:
1030    case R_DUMMY_CYCLE_EN:
1031    case R_ECO:
1032        try_flush = false;
1033        break;
1034    }
1035    s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1036no_reg_update:
1037    if (try_flush) {
1038        xilinx_spips_update_cs_lines(s);
1039        xilinx_spips_check_flush(s);
1040        xilinx_spips_update_cs_lines(s);
1041        xilinx_spips_update_ixr(s);
1042    }
1043}
1044
1045static const MemoryRegionOps spips_ops = {
1046    .read = xilinx_spips_read,
1047    .write = xilinx_spips_write,
1048    .endianness = DEVICE_LITTLE_ENDIAN,
1049};
1050
1051static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1052{
1053    q->lqspi_cached_addr = ~0ULL;
1054}
1055
1056static void xilinx_qspips_write(void *opaque, hwaddr addr,
1057                                uint64_t value, unsigned size)
1058{
1059    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1060    XilinxSPIPS *s = XILINX_SPIPS(opaque);
1061
1062    xilinx_spips_write(opaque, addr, value, size);
1063    addr >>= 2;
1064
1065    if (addr == R_LQSPI_CFG) {
1066        xilinx_qspips_invalidate_mmio_ptr(q);
1067    }
1068    if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1069        fifo8_reset(&s->rx_fifo);
1070    }
1071}
1072
1073static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1074                                        uint64_t value, unsigned size)
1075{
1076    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1077    uint32_t reg = addr / 4;
1078
1079    if (reg <= R_MOD_ID) {
1080        xilinx_qspips_write(opaque, addr, value, size);
1081    } else {
1082        switch (reg) {
1083        case R_GQSPI_CNFG:
1084            if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1085                ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1086                s->man_start_com_g = true;
1087            }
1088            s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1089            break;
1090        case R_GQSPI_GEN_FIFO:
1091            if (!fifo32_is_full(&s->fifo_g)) {
1092                fifo32_push(&s->fifo_g, value);
1093            }
1094            break;
1095        case R_GQSPI_TXD:
1096            tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1097                          ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1098            break;
1099        case R_GQSPI_FIFO_CTRL:
1100            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1101                fifo32_reset(&s->fifo_g);
1102            }
1103            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1104                fifo8_reset(&s->tx_fifo_g);
1105            }
1106            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1107                fifo8_reset(&s->rx_fifo_g);
1108            }
1109            break;
1110        case R_GQSPI_IDR:
1111            s->regs[R_GQSPI_IMR] |= value;
1112            break;
1113        case R_GQSPI_IER:
1114            s->regs[R_GQSPI_IMR] &= ~value;
1115            break;
1116        case R_GQSPI_ISR:
1117            s->regs[R_GQSPI_ISR] &= ~value;
1118            break;
1119        case R_GQSPI_IMR:
1120        case R_GQSPI_RXD:
1121        case R_GQSPI_GF_SNAPSHOT:
1122        case R_GQSPI_MOD_ID:
1123            break;
1124        default:
1125            s->regs[reg] = value;
1126            break;
1127        }
1128        xlnx_zynqmp_qspips_update_cs_lines(s);
1129        xlnx_zynqmp_qspips_check_flush(s);
1130        xlnx_zynqmp_qspips_update_cs_lines(s);
1131        xlnx_zynqmp_qspips_update_ixr(s);
1132    }
1133    xlnx_zynqmp_qspips_notify(s);
1134}
1135
1136static const MemoryRegionOps qspips_ops = {
1137    .read = xilinx_spips_read,
1138    .write = xilinx_qspips_write,
1139    .endianness = DEVICE_LITTLE_ENDIAN,
1140};
1141
1142static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1143    .read = xlnx_zynqmp_qspips_read,
1144    .write = xlnx_zynqmp_qspips_write,
1145    .endianness = DEVICE_LITTLE_ENDIAN,
1146};
1147
1148#define LQSPI_CACHE_SIZE 1024
1149
1150static void lqspi_load_cache(void *opaque, hwaddr addr)
1151{
1152    XilinxQSPIPS *q = opaque;
1153    XilinxSPIPS *s = opaque;
1154    int i;
1155    int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1156                   / num_effective_busses(s));
1157    int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1158    int cache_entry = 0;
1159    uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1160
1161    if (addr < q->lqspi_cached_addr ||
1162            addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1163        xilinx_qspips_invalidate_mmio_ptr(q);
1164        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1165        s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1166
1167        DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1168
1169        fifo8_reset(&s->tx_fifo);
1170        fifo8_reset(&s->rx_fifo);
1171
1172        /* instruction */
1173        DB_PRINT_L(0, "pushing read instruction: %02x\n",
1174                   (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1175                                       LQSPI_CFG_INST_CODE));
1176        fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1177        /* read address */
1178        DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1179        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1180            fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1181        }
1182        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1183        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1184        fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1185        /* mode bits */
1186        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1187            fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1188                                              LQSPI_CFG_MODE_SHIFT,
1189                                              LQSPI_CFG_MODE_WIDTH));
1190        }
1191        /* dummy bytes */
1192        for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1193                                   LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1194            DB_PRINT_L(0, "pushing dummy byte\n");
1195            fifo8_push(&s->tx_fifo, 0);
1196        }
1197        xilinx_spips_update_cs_lines(s);
1198        xilinx_spips_flush_txfifo(s);
1199        fifo8_reset(&s->rx_fifo);
1200
1201        DB_PRINT_L(0, "starting QSPI data read\n");
1202
1203        while (cache_entry < LQSPI_CACHE_SIZE) {
1204            for (i = 0; i < 64; ++i) {
1205                tx_data_bytes(&s->tx_fifo, 0, 1, false);
1206            }
1207            xilinx_spips_flush_txfifo(s);
1208            for (i = 0; i < 64; ++i) {
1209                rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1210            }
1211        }
1212
1213        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1214        s->regs[R_LQSPI_STS] |= u_page_save;
1215        xilinx_spips_update_cs_lines(s);
1216
1217        q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1218    }
1219}
1220
1221static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1222                              unsigned size, MemTxAttrs attrs)
1223{
1224    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1225
1226    if (addr >= q->lqspi_cached_addr &&
1227            addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1228        uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1229        *value = cpu_to_le32(*(uint32_t *)retp);
1230        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1231                   addr, *value);
1232        return MEMTX_OK;
1233    }
1234
1235    lqspi_load_cache(opaque, addr);
1236    return lqspi_read(opaque, addr, value, size, attrs);
1237}
1238
1239static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1240                               unsigned size, MemTxAttrs attrs)
1241{
1242    /*
1243     * From UG1085, Chapter 24 (Quad-SPI controllers):
1244     * - Writes are ignored
1245     * - AXI writes generate an external AXI slave error (SLVERR)
1246     */
1247    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1248                                   " (value: 0x%" PRIx64 "\n",
1249                  __func__, size << 3, offset, value);
1250
1251    return MEMTX_ERROR;
1252}
1253
1254static const MemoryRegionOps lqspi_ops = {
1255    .read_with_attrs = lqspi_read,
1256    .write_with_attrs = lqspi_write,
1257    .endianness = DEVICE_NATIVE_ENDIAN,
1258    .impl = {
1259        .min_access_size = 4,
1260        .max_access_size = 4,
1261    },
1262    .valid = {
1263        .min_access_size = 1,
1264        .max_access_size = 4
1265    }
1266};
1267
1268static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1269{
1270    XilinxSPIPS *s = XILINX_SPIPS(dev);
1271    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1272    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1273    qemu_irq *cs;
1274    int i;
1275
1276    DB_PRINT_L(0, "realized spips\n");
1277
1278    if (s->num_busses > MAX_NUM_BUSSES) {
1279        error_setg(errp,
1280                   "requested number of SPI busses %u exceeds maximum %d",
1281                   s->num_busses, MAX_NUM_BUSSES);
1282        return;
1283    }
1284    if (s->num_busses < MIN_NUM_BUSSES) {
1285        error_setg(errp,
1286                   "requested number of SPI busses %u is below minimum %d",
1287                   s->num_busses, MIN_NUM_BUSSES);
1288        return;
1289    }
1290
1291    s->spi = g_new(SSIBus *, s->num_busses);
1292    for (i = 0; i < s->num_busses; ++i) {
1293        char bus_name[16];
1294        snprintf(bus_name, 16, "spi%d", i);
1295        s->spi[i] = ssi_create_bus(dev, bus_name);
1296    }
1297
1298    s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1299    s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1300    for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1301        ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1302    }
1303
1304    sysbus_init_irq(sbd, &s->irq);
1305    for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1306        sysbus_init_irq(sbd, &s->cs_lines[i]);
1307    }
1308
1309    memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1310                          "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1311    sysbus_init_mmio(sbd, &s->iomem);
1312
1313    s->irqline = -1;
1314
1315    fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1316    fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1317}
1318
1319static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1320{
1321    XilinxSPIPS *s = XILINX_SPIPS(dev);
1322    XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1323    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1324
1325    DB_PRINT_L(0, "realized qspips\n");
1326
1327    s->num_busses = 2;
1328    s->num_cs = 2;
1329    s->num_txrx_bytes = 4;
1330
1331    xilinx_spips_realize(dev, errp);
1332    memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1333                          (1 << LQSPI_ADDRESS_BITS) * 2);
1334    sysbus_init_mmio(sbd, &s->mmlqspi);
1335
1336    q->lqspi_cached_addr = ~0ULL;
1337}
1338
1339static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1340{
1341    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1342    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1343
1344    if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1345        error_setg(errp,
1346                   "qspi dma burst size %u exceeds maximum limit %d",
1347                   s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1348        return;
1349    }
1350    xilinx_qspips_realize(dev, errp);
1351    fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1352    fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1353    fifo32_create(&s->fifo_g, 32);
1354}
1355
1356static void xlnx_zynqmp_qspips_init(Object *obj)
1357{
1358    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1359
1360    object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1361                             (Object **)&rq->dma,
1362                             object_property_allow_set_link,
1363                             OBJ_PROP_LINK_STRONG,
1364                             NULL);
1365}
1366
1367static int xilinx_spips_post_load(void *opaque, int version_id)
1368{
1369    xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1370    xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1371    return 0;
1372}
1373
1374static const VMStateDescription vmstate_xilinx_spips = {
1375    .name = "xilinx_spips",
1376    .version_id = 2,
1377    .minimum_version_id = 2,
1378    .post_load = xilinx_spips_post_load,
1379    .fields = (VMStateField[]) {
1380        VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1381        VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1382        VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1383        VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1384        VMSTATE_END_OF_LIST()
1385    }
1386};
1387
1388static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1389{
1390    XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1391    XilinxSPIPS *qs = XILINX_SPIPS(s);
1392
1393    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1394        fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1395        xlnx_zynqmp_qspips_update_ixr(s);
1396        xlnx_zynqmp_qspips_update_cs_lines(s);
1397    }
1398    return 0;
1399}
1400
1401static const VMStateDescription vmstate_xilinx_qspips = {
1402    .name = "xilinx_qspips",
1403    .version_id = 1,
1404    .minimum_version_id = 1,
1405    .fields = (VMStateField[]) {
1406        VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1407                       vmstate_xilinx_spips, XilinxSPIPS),
1408        VMSTATE_END_OF_LIST()
1409    }
1410};
1411
1412static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1413    .name = "xlnx_zynqmp_qspips",
1414    .version_id = 1,
1415    .minimum_version_id = 1,
1416    .post_load = xlnx_zynqmp_qspips_post_load,
1417    .fields = (VMStateField[]) {
1418        VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1419                       vmstate_xilinx_qspips, XilinxQSPIPS),
1420        VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1421        VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1422        VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1423        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1424        VMSTATE_END_OF_LIST()
1425    }
1426};
1427
1428static Property xilinx_zynqmp_qspips_properties[] = {
1429    DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1430    DEFINE_PROP_END_OF_LIST(),
1431};
1432
1433static Property xilinx_spips_properties[] = {
1434    DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1435    DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1436    DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1437    DEFINE_PROP_END_OF_LIST(),
1438};
1439
1440static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1441{
1442    DeviceClass *dc = DEVICE_CLASS(klass);
1443    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1444
1445    dc->realize = xilinx_qspips_realize;
1446    xsc->reg_ops = &qspips_ops;
1447    xsc->rx_fifo_size = RXFF_A_Q;
1448    xsc->tx_fifo_size = TXFF_A_Q;
1449}
1450
1451static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1452{
1453    DeviceClass *dc = DEVICE_CLASS(klass);
1454    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1455
1456    dc->realize = xilinx_spips_realize;
1457    dc->reset = xilinx_spips_reset;
1458    dc->props = xilinx_spips_properties;
1459    dc->vmsd = &vmstate_xilinx_spips;
1460
1461    xsc->reg_ops = &spips_ops;
1462    xsc->rx_fifo_size = RXFF_A;
1463    xsc->tx_fifo_size = TXFF_A;
1464}
1465
1466static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1467{
1468    DeviceClass *dc = DEVICE_CLASS(klass);
1469    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1470
1471    dc->realize = xlnx_zynqmp_qspips_realize;
1472    dc->reset = xlnx_zynqmp_qspips_reset;
1473    dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1474    dc->props = xilinx_zynqmp_qspips_properties;
1475    xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1476    xsc->rx_fifo_size = RXFF_A_Q;
1477    xsc->tx_fifo_size = TXFF_A_Q;
1478}
1479
1480static const TypeInfo xilinx_spips_info = {
1481    .name  = TYPE_XILINX_SPIPS,
1482    .parent = TYPE_SYS_BUS_DEVICE,
1483    .instance_size  = sizeof(XilinxSPIPS),
1484    .class_init = xilinx_spips_class_init,
1485    .class_size = sizeof(XilinxSPIPSClass),
1486};
1487
1488static const TypeInfo xilinx_qspips_info = {
1489    .name  = TYPE_XILINX_QSPIPS,
1490    .parent = TYPE_XILINX_SPIPS,
1491    .instance_size  = sizeof(XilinxQSPIPS),
1492    .class_init = xilinx_qspips_class_init,
1493};
1494
1495static const TypeInfo xlnx_zynqmp_qspips_info = {
1496    .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1497    .parent = TYPE_XILINX_QSPIPS,
1498    .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1499    .instance_init  = xlnx_zynqmp_qspips_init,
1500    .class_init = xlnx_zynqmp_qspips_class_init,
1501};
1502
1503static void xilinx_spips_register_types(void)
1504{
1505    type_register_static(&xilinx_spips_info);
1506    type_register_static(&xilinx_qspips_info);
1507    type_register_static(&xlnx_zynqmp_qspips_info);
1508}
1509
1510type_init(xilinx_spips_register_types)
1511